13 ms·

Wow. This is the ultimate IoT failure scenario, the product is in use but no longer supported and an exploit can hit it from the Internet. I suspect there will

Wow. This is the ultimate IoT failure scenario, the product is in use but no longer supported and an exploit can hit it from the Internet. I suspect there will be litigation, but I am not a lawyer. I will be interested to see it though, what is the responsibility for using things post end-of-life? What we might see is a new “your on your own” mode built into this sort of appliance that once EOL hits it asks you to affirmatively indicate that you know it is no longer supported and any further use comes at your own risk. It is also another great case study for open source NAS devices, like the TrueNAS line, that you can patch even if iXSystems goes away.

freeone3000 5y ago
I think the issue here is "end of life" is defined way too soon for portable hard drives. The mechanical parts have a 4% annual failure rate, or a half-life of 12.5 years. The software should be supported for that long.
- throwawayboise 5y ago
  12 years? Typical business life of a computer is 5 years. Typical service/support agreement is 1-3 years. Try getting Apple to address a failed hard drive that's 12 years old. They'd laugh in your face.
  - lrem 5y ago
    As they should. A drive failing after 12 years is a successful outcome that only 50% of drives reach.
    - mnw21cam 5y ago
      Yes, but there's a difference between the expected rate of mechanical failure, and the existence of a software bug. The current fault erases everything on the drive. That can be equated fairly equally with mechanical failure. Let's imagine a different bug for instance, that allows anyone on the internet to read/write all the data on the drive. If one of these bugs emerged after 12 years, then there is a much stronger argument that the manufacturer should fix it, because it is a fundamental fault with the device. Under the sale of goods act of 1979, the device must be suitable for the purpose for which it was sold, and there is no time limit on that, so any consumer with the device could demand that the person who sold it to them fix it. The device was unsuitable for the purpose for which it was sold from day one - it just took 12 years to find that out.
  - loktarogar 5y ago
    They would. But if there was a software vulnerability that would wipe out the hard drives of computers still realistically in use, much past that 3 year agreement expiry? i'd expect them to be on that.
    - throwawayboise 5y ago
      Suppose there were a vulnerability in Mac OS X Tiger that wiped the hard drive of any G4 Powerbook connected to the internet. Would you expect Apple to be on that?
      - newsbinator 5y ago
        Actually yes, in that scenario
        dmz73 5y ago
        There are almost 2800 CVEs listed for Mac OS. Do you really believe that none of those are remotely exploitable on some old version of Max OS?
      - bredren 5y ago
        The company is among the most responsive to security issues because security is directly tied to their core value around data privacy.
        slipframe 5y ago
        From conversations on this website about Apple's responsiveness/attitude to security researchers hunting bounties, I have gotten a contrary impression about Apple.
        kergonath 5y ago
        They are not perfect and not always as responsive as I’d like. They issue security updates for their current OS and 2 versions before, AFAIK.
  - Psyonic 5y ago
    My 15" 2013 MBP runs Big Sur just fine... Sure, not quite 12 years, but still
    - hellweaver666 5y ago
      I have a 2010 MBP that I use as a print server... it still gets occasional updates.
  - code_duck 5y ago
    I have two 2010-11 MacBook Pros that are working perfectly with their original mechanical hard drives. They even still get software updates.
  - alpaca128 5y ago
    ...and yet Apple still fixes security bugs in your OS even if your laptop is outside of warranty. I say as long as the device still connects to the internet without a clear error message etc. it should be supported. Realistically the average user has better things to do than check the support period of a random network drive they bought at some sale.
  - sbierwagen 5y ago
    That... clearly isn't what GP is talking about? The word "software" was used.
    - freeone3000 5y ago
      Here is an at-the-time writeup of the unit in question: https://www.wired.com/2012/02/wd-my-book-live-duo/ https://www.wired.com/2012/02/wd-my-book-live-duo/ WD sells the hardware, hard drive, and software as one sealed unit. The part that fails first will be the hard drive inside. The unit shouldn't be end-of-life until it actually should be expected to fail. (WD claims the units were end of life in 2016)
  - bayindirh 5y ago
    What if the appliance has removable drives, so its life is much longer than the drives themselves? e.g.: Live Duo 8TB: https://productimages.hepsiburada.net/s/12/500/8922723713074.jpg https://productimages.hepsiburada.net/s/12/500/8922723713074...
- deleted 5y ago
  [deleted]
- cjg 5y ago
  I agree with your conclusion of increasing the length of support. But your half-life analysis isn't really the right choice. Hard drives tend to have a bath-tub failure rate: https://en.wikipedia.org/wiki/Bathtub_curve https://en.wikipedia.org/wiki/Bathtub_curve
  - Y_Y 5y ago
    Here's an explanation with some real-world data: https://www.backblaze.com/blog/how-long-do-disk-drives-last/ https://www.backblaze.com/blog/how-long-do-disk-drives-last/ (Also, my hard drives always fail after I put them in the bathtub. Lol.)
  - bayindirh 5y ago
    Some of the WD MyBook Live systems have removable drives. This makes drive life irrelevant at least for these drives. E.g.: Mybook Live Duo 8TB: https://productimages.hepsiburada.net/s/12/500/8922723713074.jpg https://productimages.hepsiburada.net/s/12/500/8922723713074...
- Fnoord 5y ago
  You can probably open up the portable hard drive and remove the physical hard drive, ending up with a 3.5". Some contain high quality server hard drives (some don't) for cheap price. You do lose your warranty though.
- rswail 5y ago
  I think that we need to separate the life of the hardware (WD My Book) and the life of the cloud service (the "Live" bit). The drives themselves and their function as a NAS on a LAN is still fine. When "Live" EOLed, they should have turned off the servers and disabled the function. If they weren't going to service/support it anymore, then they should have been honest about it. Of course, their consumers would have screamed, so they did the worst possible thing, kept the service running as-is and didn't make it clear that people were leaving themselves open to attack.
  - kingsuper20 5y ago
    > I think that we need to separate the life of the hardware (WD My Book) and the life of the cloud service (the "Live" bit). That makes me think of the internet radio owners (Grace Digital, Yamaha, etc.) that all had their products brick because the underlying look-up service just up and went away. No problem. You just have to buy another hunk of plastic and microprocessor.
- deadbunny 5y ago
  There is also EOL for the HDDs and EOL for the NAS itself. HDDs are easily replaceable and the NAS hardware itself should last for a long time. It's a linux box that shares a filesystem via CIFS/NFS no need to throw that out when a HDD dies, that'll last for a decade, if not more.
sharken 5y ago
It's more like a business failure as in the decision to discontinue the devices were taken prematurely. But really as pointed out above, any IoT device will eventually have a security flaw discovered if updates are stopped. As a consumer the best bet is to switch to a supported device or disconnect the device from the internet.
- satyamkapoor 5y ago
  True. This is what should be written in bold when you are buying any IoT device specifically those consumer grade lamps from small firms. It's fun to control around from our phones but after 2 years it won't be much fun someone else controlling around
- alias_neo 5y ago
  As a consumer, this is the reason I have boxes with hundreds of £s worth of routers which I've taking out of commission, because the manufacturer stopped updating them. This really shouldn't have to be a consumer issue, it's wasteful to have to replace something like a router after the short EoL and inevitable vulnerabilities are found. Perhaps we need more modularity, so core components can be swapped out to upgrade them.
  - dageshi 5y ago
    Seems like the real answer is, you have to pay for ongoing support or the base cost of the device has to go up a lot or you roll your own with pc hardware and you're responsible for updating and making sure everything still works.
    - alias_neo 5y ago
      Personally, I'm not opposed to any of those plans. PC hardware isn't ideal because you lose the benefits of specialised offload capabilities. I'd be willing to pay a nominal annual fee for devices which are important to get firmware updates; router, WiFi AP, phone, etc. To an extent I've partly achieved the modularity I speak of; after becoming fed up with decommissioning WiFi routers every couple years, I moved to router, switch, AP (Ubiquiti gear).
oblio 5y ago
When a car manufacturer sells a car, in many parts of the world they're supposed to still offer parts for it for 7 years after they stop selling it, by law.
- joering2 5y ago
  Moreover, I think WD defense here will be that while you could, you did not have to plug your WD device to internet, in order for it to serve its purpose. They will try to argue that the majority of their offer is hard discs, and if your drive has extra ability to connect to internet, that's extra feature.
  - cesarb 5y ago
    Yes, but that "extra feature" is most probably the main reason that model was bought instead of a cheaper model without a network connection. That is, that "extra ability" would be in fact the main differentiator of that model.
- roel_v 5y ago
  But consumer electronics are written off on much shorter timeframes than cars. Are we going to require support for electronics for 7 years? I would be in favor of it, but I don't see it happen. Device was EoL in 2015, the vuln is from 2019, breach 2021. Even if we take the vuln date, that's 4 years after EoL. The question then becomes: is it reasonable to say that electronics are expected to have a life half of that of cars? I could argue both ways on this.
  - sokoloff 5y ago
    NB: The average age of a car in the US hit 12.1 years last year. https://www.reuters.com/business/autos-transportation/average-age-us-vehicles-hit-record-121-years-2020-ihs-markit-2021-06-14/ https://www.reuters.com/business/autos-transportation/averag...
  - dtech 5y ago
    I'd argue that this is serious enough that EOL doesn't apply. Yeah sure EOL for updates, features, minor issues etc. But this is literally "Anyone in the world can remotely make your product unusable and destroy everything on it while you use it as intended" I don't care if a car manifacturer EOL'ed a car model, if an issue gets discovered that will make the engine explode at random they better do recall.
rocqua 5y ago
> I suspect there will be litigation, but I am not a lawyer. I will be interested to see it though, what is the responsibility for using things post end-of-life? Any situation where "you are on your own" should include the dropping of protections preventing you from actually fixing the device. If the manufacturer refuses to produce updates, that should NOT mean there is no way to update the software on the device.
brobdingnagians 5y ago
I am trying to get rid of any smart devices in my life. I need less things connected to the internet not more. I bought Bruce Shneier's "Click Here to Kill Everybody, and that just convinced me even more. Software is a weak point, and I'd rather have the least amount possible in my "mission critical" everyday life gadgets. I want single-purpose, purpose built devices that do that one thing very well, without connecting to the internet for a whole host of secondary, and mostly useless or even harmful surveillance, reasons.
- bryanrasmussen 5y ago
  as most products become connected you will have to pay a premium for products that are not - especially as companies try to make profits from tracking (as in SmartTvs). People who are not rich enough to buy everything single purpose will have to pick and choose.
  - pope_meat 5y ago
    Personally I hope ecological collapse nips this black mirror future were tumbling in to. Things feel bleak.
    - bingu 5y ago
      Ecological collapse will likely tumble us more into a black mirror future as populations become increasingly dependent on technology to fulfill their needs.
    - majewsky 5y ago
      If anything, ecological collapse might hasten this future. Just last week, there was this news about the Texas power company that remotely raised temperatures on people's thermostats to save power and avoid brownouts/blackouts. This predictably caused public outrage as people discovered what was in the fine print that they signed without reading, but from the perspective of the power company, everything worked as intended, so I absolutely expect to push these remote-controllable thermostats even harder moving forward.
atoav 5y ago
IOT products are inherently unsustainable.
- deleted 5y ago
  [deleted]
vertis 5y ago
If you sell me a HD/IoT, and say it does X/Y/Z and then no longer want to provide X/Y/Z, I should get my money back. This whole, "ah sorry we decided to end-of-life that because we couldn't make any more money off it" is so many levels of bullshit. It's also part of a broader attitude on not repairing anything. Battery dead in your activity tracker? throw it out and buy a new one. Worse still, the band has degraded but the electronics are all fine? still throw it out (or put it in a drawer to never come back out). Closely aligned to a recent story where Amazon is/was destroying masses of products that hadn't been sold. The waste is just extraordinary.
- thomascgalvin 5y ago
  > If you sell me a HD/IoT, and say it does X/Y/Z and then no longer want to provide X/Y/Z, I should get my money back. This is my takeaway from the whole Peloton fiasco. If you spend thousands of dollars on a product, and after the purchase the company bricks the product, the company should legally owe you a full refund.
  - pbhjpbhj 5y ago
    Under the Consumer Rights Act in the UK there is no end of 'warranty' period. If the product expires when it would be reasonably expected to work then you have a claim against the company. They can fix, like-for-like replace, or pay you money. They do get to reduce the compensation based on the use you've had of the product, but that seems reasonable.
  - tornato7 5y ago
    I had a perfectly functioning Phillips Hue lighting system, then one day Phillips decided it was no longer supported and I had to buy an upgraded system to get the same features that I already had.

freeone3000 5y ago

I think the issue here is "end of life" is defined way too soon for portable hard drives. The mechanical parts have a 4% annual failure rate, or a half-life of 12.5 years. The software should be supported for that long.

throwawayboise 5y ago
12 years? Typical business life of a computer is 5 years. Typical service/support agreement is 1-3 years. Try getting Apple to address a failed hard drive that's 12 years old. They'd laugh in your face.
- lrem 5y ago
  As they should. A drive failing after 12 years is a successful outcome that only 50% of drives reach.
  - mnw21cam 5y ago
    Yes, but there's a difference between the expected rate of mechanical failure, and the existence of a software bug. The current fault erases everything on the drive. That can be equated fairly equally with mechanical failure. Let's imagine a different bug for instance, that allows anyone on the internet to read/write all the data on the drive. If one of these bugs emerged after 12 years, then there is a much stronger argument that the manufacturer should fix it, because it is a fundamental fault with the device. Under the sale of goods act of 1979, the device must be suitable for the purpose for which it was sold, and there is no time limit on that, so any consumer with the device could demand that the person who sold it to them fix it. The device was unsuitable for the purpose for which it was sold from day one - it just took 12 years to find that out.
- loktarogar 5y ago
  They would. But if there was a software vulnerability that would wipe out the hard drives of computers still realistically in use, much past that 3 year agreement expiry? i'd expect them to be on that.
  - throwawayboise 5y ago
    Suppose there were a vulnerability in Mac OS X Tiger that wiped the hard drive of any G4 Powerbook connected to the internet. Would you expect Apple to be on that?
    - newsbinator 5y ago
      Actually yes, in that scenario
      - dmz73 5y ago
        There are almost 2800 CVEs listed for Mac OS. Do you really believe that none of those are remotely exploitable on some old version of Max OS?
    - bredren 5y ago
      The company is among the most responsive to security issues because security is directly tied to their core value around data privacy.
      - slipframe 5y ago
        From conversations on this website about Apple's responsiveness/attitude to security researchers hunting bounties, I have gotten a contrary impression about Apple.
        kergonath 5y ago
        They are not perfect and not always as responsive as I’d like. They issue security updates for their current OS and 2 versions before, AFAIK.
- Psyonic 5y ago
  My 15" 2013 MBP runs Big Sur just fine... Sure, not quite 12 years, but still
  - hellweaver666 5y ago
    I have a 2010 MBP that I use as a print server... it still gets occasional updates.
- code_duck 5y ago
  I have two 2010-11 MacBook Pros that are working perfectly with their original mechanical hard drives. They even still get software updates.
- alpaca128 5y ago
  ...and yet Apple still fixes security bugs in your OS even if your laptop is outside of warranty. I say as long as the device still connects to the internet without a clear error message etc. it should be supported. Realistically the average user has better things to do than check the support period of a random network drive they bought at some sale.
- sbierwagen 5y ago
  That... clearly isn't what GP is talking about? The word "software" was used.
  - freeone3000 5y ago
    Here is an at-the-time writeup of the unit in question: https://www.wired.com/2012/02/wd-my-book-live-duo/ https://www.wired.com/2012/02/wd-my-book-live-duo/ WD sells the hardware, hard drive, and software as one sealed unit. The part that fails first will be the hard drive inside. The unit shouldn't be end-of-life until it actually should be expected to fail. (WD claims the units were end of life in 2016)
- bayindirh 5y ago
  What if the appliance has removable drives, so its life is much longer than the drives themselves? e.g.: Live Duo 8TB: https://productimages.hepsiburada.net/s/12/500/8922723713074.jpg https://productimages.hepsiburada.net/s/12/500/8922723713074...
deleted 5y ago
[deleted]
cjg 5y ago
I agree with your conclusion of increasing the length of support. But your half-life analysis isn't really the right choice. Hard drives tend to have a bath-tub failure rate: https://en.wikipedia.org/wiki/Bathtub_curve https://en.wikipedia.org/wiki/Bathtub_curve
- Y_Y 5y ago
  Here's an explanation with some real-world data: https://www.backblaze.com/blog/how-long-do-disk-drives-last/ https://www.backblaze.com/blog/how-long-do-disk-drives-last/ (Also, my hard drives always fail after I put them in the bathtub. Lol.)
- bayindirh 5y ago
  Some of the WD MyBook Live systems have removable drives. This makes drive life irrelevant at least for these drives. E.g.: Mybook Live Duo 8TB: https://productimages.hepsiburada.net/s/12/500/8922723713074.jpg https://productimages.hepsiburada.net/s/12/500/8922723713074...
Fnoord 5y ago
You can probably open up the portable hard drive and remove the physical hard drive, ending up with a 3.5". Some contain high quality server hard drives (some don't) for cheap price. You do lose your warranty though.
rswail 5y ago
I think that we need to separate the life of the hardware (WD My Book) and the life of the cloud service (the "Live" bit). The drives themselves and their function as a NAS on a LAN is still fine. When "Live" EOLed, they should have turned off the servers and disabled the function. If they weren't going to service/support it anymore, then they should have been honest about it. Of course, their consumers would have screamed, so they did the worst possible thing, kept the service running as-is and didn't make it clear that people were leaving themselves open to attack.
- kingsuper20 5y ago
  > I think that we need to separate the life of the hardware (WD My Book) and the life of the cloud service (the "Live" bit). That makes me think of the internet radio owners (Grace Digital, Yamaha, etc.) that all had their products brick because the underlying look-up service just up and went away. No problem. You just have to buy another hunk of plastic and microprocessor.
deadbunny 5y ago
There is also EOL for the HDDs and EOL for the NAS itself. HDDs are easily replaceable and the NAS hardware itself should last for a long time. It's a linux box that shares a filesystem via CIFS/NFS no need to throw that out when a HDD dies, that'll last for a decade, if not more.

sharken 5y ago

It's more like a business failure as in the decision to discontinue the devices were taken prematurely. But really as pointed out above, any IoT device will eventually have a security flaw discovered if updates are stopped. As a consumer the best bet is to switch to a supported device or disconnect the device from the internet.

satyamkapoor 5y ago
True. This is what should be written in bold when you are buying any IoT device specifically those consumer grade lamps from small firms. It's fun to control around from our phones but after 2 years it won't be much fun someone else controlling around
alias_neo 5y ago
As a consumer, this is the reason I have boxes with hundreds of £s worth of routers which I've taking out of commission, because the manufacturer stopped updating them. This really shouldn't have to be a consumer issue, it's wasteful to have to replace something like a router after the short EoL and inevitable vulnerabilities are found. Perhaps we need more modularity, so core components can be swapped out to upgrade them.
- dageshi 5y ago
  Seems like the real answer is, you have to pay for ongoing support or the base cost of the device has to go up a lot or you roll your own with pc hardware and you're responsible for updating and making sure everything still works.
  - alias_neo 5y ago
    Personally, I'm not opposed to any of those plans. PC hardware isn't ideal because you lose the benefits of specialised offload capabilities. I'd be willing to pay a nominal annual fee for devices which are important to get firmware updates; router, WiFi AP, phone, etc. To an extent I've partly achieved the modularity I speak of; after becoming fed up with decommissioning WiFi routers every couple years, I moved to router, switch, AP (Ubiquiti gear).

oblio 5y ago

When a car manufacturer sells a car, in many parts of the world they're supposed to still offer parts for it for 7 years after they stop selling it, by law.

joering2 5y ago
Moreover, I think WD defense here will be that while you could, you did not have to plug your WD device to internet, in order for it to serve its purpose. They will try to argue that the majority of their offer is hard discs, and if your drive has extra ability to connect to internet, that's extra feature.
- cesarb 5y ago
  Yes, but that "extra feature" is most probably the main reason that model was bought instead of a cheaper model without a network connection. That is, that "extra ability" would be in fact the main differentiator of that model.
roel_v 5y ago
But consumer electronics are written off on much shorter timeframes than cars. Are we going to require support for electronics for 7 years? I would be in favor of it, but I don't see it happen. Device was EoL in 2015, the vuln is from 2019, breach 2021. Even if we take the vuln date, that's 4 years after EoL. The question then becomes: is it reasonable to say that electronics are expected to have a life half of that of cars? I could argue both ways on this.
- sokoloff 5y ago
  NB: The average age of a car in the US hit 12.1 years last year. https://www.reuters.com/business/autos-transportation/average-age-us-vehicles-hit-record-121-years-2020-ihs-markit-2021-06-14/ https://www.reuters.com/business/autos-transportation/averag...
- dtech 5y ago
  I'd argue that this is serious enough that EOL doesn't apply. Yeah sure EOL for updates, features, minor issues etc. But this is literally "Anyone in the world can remotely make your product unusable and destroy everything on it while you use it as intended" I don't care if a car manifacturer EOL'ed a car model, if an issue gets discovered that will make the engine explode at random they better do recall.

rocqua 5y ago

> I suspect there will be litigation, but I am not a lawyer. I will be interested to see it though, what is the responsibility for using things post end-of-life? Any situation where "you are on your own" should include the dropping of protections preventing you from actually fixing the device. If the manufacturer refuses to produce updates, that should NOT mean there is no way to update the software on the device.

brobdingnagians 5y ago

I am trying to get rid of any smart devices in my life. I need less things connected to the internet not more. I bought Bruce Shneier's "Click Here to Kill Everybody, and that just convinced me even more. Software is a weak point, and I'd rather have the least amount possible in my "mission critical" everyday life gadgets. I want single-purpose, purpose built devices that do that one thing very well, without connecting to the internet for a whole host of secondary, and mostly useless or even harmful surveillance, reasons.

bryanrasmussen 5y ago
as most products become connected you will have to pay a premium for products that are not - especially as companies try to make profits from tracking (as in SmartTvs). People who are not rich enough to buy everything single purpose will have to pick and choose.
- pope_meat 5y ago
  Personally I hope ecological collapse nips this black mirror future were tumbling in to. Things feel bleak.
  - bingu 5y ago
    Ecological collapse will likely tumble us more into a black mirror future as populations become increasingly dependent on technology to fulfill their needs.
  - majewsky 5y ago
    If anything, ecological collapse might hasten this future. Just last week, there was this news about the Texas power company that remotely raised temperatures on people's thermostats to save power and avoid brownouts/blackouts. This predictably caused public outrage as people discovered what was in the fine print that they signed without reading, but from the perspective of the power company, everything worked as intended, so I absolutely expect to push these remote-controllable thermostats even harder moving forward.

atoav 5y ago

IOT products are inherently unsustainable.

deleted 5y ago
[deleted]

vertis 5y ago

If you sell me a HD/IoT, and say it does X/Y/Z and then no longer want to provide X/Y/Z, I should get my money back. This whole, "ah sorry we decided to end-of-life that because we couldn't make any more money off it" is so many levels of bullshit. It's also part of a broader attitude on not repairing anything. Battery dead in your activity tracker? throw it out and buy a new one. Worse still, the band has degraded but the electronics are all fine? still throw it out (or put it in a drawer to never come back out). Closely aligned to a recent story where Amazon is/was destroying masses of products that hadn't been sold. The waste is just extraordinary.

thomascgalvin 5y ago
> If you sell me a HD/IoT, and say it does X/Y/Z and then no longer want to provide X/Y/Z, I should get my money back. This is my takeaway from the whole Peloton fiasco. If you spend thousands of dollars on a product, and after the purchase the company bricks the product, the company should legally owe you a full refund.
- pbhjpbhj 5y ago
  Under the Consumer Rights Act in the UK there is no end of 'warranty' period. If the product expires when it would be reasonably expected to work then you have a claim against the company. They can fix, like-for-like replace, or pay you money. They do get to reduce the compensation based on the use you've had of the product, but that seems reasonable.
- tornato7 5y ago
  I had a perfectly functioning Phillips Hue lighting system, then one day Phillips decided it was no longer supported and I had to buy an upgraded system to get the same features that I already had.